Statement of the Honorable James B. Lockhart, III
Deputy Commissioner of Social Security
Testimony before the Senate Finance Committee
Hearing on the Homeland Security Threat from Document Fraud
Identity Theft and Social Security Number Misuse
September 9, 2003
Mr. Chairman and Members of the Committee:
Thank you for asking me to be here today to discuss issues surrounding document fraud, identity theft, and misuse of the Social Security Number (SSN). I am pleased to have the opportunity to tell you about the efforts that SSA has made to strengthen the integrity of the SSN, and to describe the SSN verification processes we have in place. I also want to discuss what we are doing to help states to verify the names and SSNs of individuals who apply for driver's licenses. The SSN is the single most widely used identifier for Federal and State governments as well as the private sector. As the number of uses for SSNs increases, especially in the private sector, so the potential for misuse of the SSN increases.
The tragic events of September 11, 2001, have brought home to all of us the need to strengthen the safeguards to protect against the misuse of the SSN. Since Commissioner Barnhart and I have been at the Social Security Administration, we have made protecting the SSN and strengthening the integrity of the processes used to assign these numbers a major Agency priority. We have made a number of significant enhancements in the last two years and will continue to look for ways to improve on the safeguards now in place.
History of the Social Security Number and Card
First, I would like to describe the history and the original purpose of the SSN and the Social Security card. Following the enactment of the Social Security Act in 1935, the SSN was developed to keep track of the earnings of people who worked in jobs covered under the new Social Security program. The rules regarding the assignment of SSNs to workers were published in Treasury regulations in 1936.
The Social Security card reflects the number that has been assigned to each individual who applies for an SSN. The card, when shown to an employer, assists the employer in assuring that earnings are reported properly. Public information documents issued early in the administration of the program advised workers to share their SSNs only with their employers. Initially, the only purpose of the SSN was to assure that SSA kept accurate records of earnings under Social Security so that we could pay benefits based on those earnings.
Use of the SSN Expands Over Time
Although the purpose of the SSN was narrowly drawn from the outset of the program, use of the SSN as a convenient means of identifying people in large systems of records has increased over the years. In 1943, Executive Order 9397 required Federal agencies to use the SSN in any new record systems for the purpose of identifying individuals. This use proved to be an early reflection of what has become an enduring trend to expand the use of the SSN. The simplicity and efficiency of using a unique number that most people already possessed encouraged widespread use of the SSN by both government agencies and private enterprises, especially as they adapted their record-keeping and business systems to automated data processing.
In 1961, the Federal Civil Service Commission established a numerical identification system for all Federal employees using the SSN as the identification number. The next year, the Internal Revenue Service (IRS) decided to begin using the SSN as its taxpayer identification (TIN) for individuals. In 1967, the Defense Department adopted the SSN as the service number for military personnel. At the same time, use of the SSN for computer and other accounting systems spread throughout State and local governments, to banks, credit bureaus, hospitals, educational institutions and other parts of the private sector. During this time, there were no legislative restrictions on the use of the SSN.
Statutory Provision Relating to the Public Sector
The first explicit statutory authority to issue SSNs was not enacted until 1972, when Congress required that SSA assign SSNs to all noncitizens authorized to work in this country and take affirmative steps to assign SSNs to children and anyone receiving or applying for a Federally funded benefit. This provision was prompted by Congressional concerns about welfare fraud and about noncitizens working in the U.S. illegally. Subsequent Congresses have enacted legislation which requires an SSN in order to receive Supplemental Security Income (SSI), Temporary Assistance to Needy Families (TANF), Medicaid, and food stamps. Additional legislation authorized States to use the SSN in the administration of tax, general public assistance, driver's license, or motor vehicle registration law within its jurisdiction.
The Privacy Act was enacted in 1974 partly in response to concern about the widespread use of the SSN. It provided that, except when required by Federal statute or regulation adopted prior to January 1975, no Federal, State, or government agency could withhold benefits from a person simply because the person refused to furnish his or her SSN.
In the 1980s, new legislation provided for additional uses of the SSN, including employment eligibility verification, military draft registration, driver's licenses, and for operators of stores that redeem food stamps. Legislation was also enacted that required taxpayers to provide the SSN for each dependent age 5 or older. The age requirement was lowered subsequently, and an SSN is now required for dependents regardless of age.
In the 1990s, SSN usage continued to expand with legislation that authorized its use for jury selection and for administration of Federal workers' compensation laws. A major expansion of SSN usage was provided in welfare reform legislation enacted in 1996. Under welfare reform, to improve child support enforcement, the SSN was authorized to be recorded in a broad array of records, including applications for professional licenses, driver's licenses, and marriage licenses, divorce decrees, support orders, and paternity determinations. In addition, the SSN is integral to the operation of the State and National New Hire Directories that were established in welfare reform to enhance collection of child support payments.
Use of the SSN by the Private Sector
Currently, there are no restrictions in Federal law on the use of the SSN by the private sector. Businesses may ask for a customer's SSN for such things as renting a video, applying for credit cards, obtaining medical services, and applying for public utilities. Customers may refuse to provide the number, however, the business may, in turn, decline to furnish the product or service.
Continuing advances in computer technology and the ready availability of computerized data have encouraged the growth of information brokers who amass and sell large volumes of personal information, including SSNs collected by businesses. When possible, information brokers store and retrieve information about an individual by that individual's SSN because it is more likely than any other identifier to maintain unique records for each specific individual.
Contemporary Challenges Regarding the SSN
As you can see, Mr. Chairman, use of the SSN is widespread in our society. This usage is the product of numerous decisions made over the years. The cumulative effect is to make the SSN an important element in establishing and maintaining an individual's identity in various record systems, and the ability of individuals to function in our society and economy. As a result, the SSN is prized by criminals who are intent on stealing another person's identity, or creating a false identity.
Accomplished identity thieves use a variety of methods to gain access to personal data. We at the Social Security Administration want to do whatever we can to help prevent identity theft and assist in the apprehension and conviction of those who engage in this crime.
Agency Response to SSN Misuse and Identity Theft
Validating requests for SSNs and issuing Social Security cards is a major workload for SSA. For fiscal year 2002, we issued 18 million Social Security cards, of which 12.4 million were replacement cards. Of the approximately 5.6 million new SSNs issued, over 1 million were issued to noncitizens, the vast majority of whom were issued an SSN because their immigration status authorizes them to work. Both the events of September 11, 2001, and the rapid increase in the incidence of identity theft have emphasized the importance of strengthening the administrative processes employed by SSA in assigning SSNs. In the fall of 2001, SSA formed a high-level team which has met regularly ever since to recommend and follow progress toward policy and procedural enhancements to strengthen our ability to prevent criminals from using SSNs and cards to advance their activities. Some of these initiatives have delayed the receipt of SSNs for some citizens and noncitizens. However, we believe these measures are necessary to ensure the integrity of the SSN issuance process and to assure that only those who are entitled to an SSN receive one.
Shortly after September 11, we began a cycle of retraining for all of our employees regarding the rules for enumerating individuals, with a special focus on the rules relating to noncitizens. We started with refresher training for all involved staff, and have followed on with additional periodic special training and management oversight.
We have eliminated a significant vulnerability in our enumeration processes relating to requests for SSNs from individuals who are not citizens of the U.S. The vulnerability stemmed from the ability of counterfeiters to produce high-quality replicas of immigration documents issued by the Department of Homeland Security (DHS). While we have always emphasized and continue to emphasize with our employees the importance of scrutinizing all immigration documents to identify those that are obviously fraudulent, we concluded that improvements in desk top publishing software made such scrutiny unreliable as a defense against counterfeit documents.
Therefore, on July 1, 2002, we began verifying with DHS any documents issued by them before assigning an SSN. We are able to verify most of these electronically. But if a record of the immigration document has not been established on DHS's electronic system, we request written confirmation from DHS that the documents submitted are bona fide. No SSN is assigned until the authenticity of the immigration documents has been verified. While verification of all documents has delayed SSN issuance to some noncitizens, we believe that such verification is an important step in ensuring the integrity of the enumeration process.
We have been successful in establishing a process, administered jointly by SSA and the Department of State, to assign SSNs and issue SSN cards to selected noncitizens as part of the process that allows them to enter the country as permanent residents. Under this process, known as "Enumeration at Entry (EAE)," the data required to assign an SSN, including verification of the individual's immigration and work authorization status, are provided to SSA by the Department of State (DOS) and the DHS (formerly INS).
We have also revised our verification processes with respect to young children. The vast majority of children receive an SSN through our "Enumeration at Birth (EAB)" program where parents can request an SSN at the same time that the child's birth is registered with the state vital statistics organization. Where an SSN is not requested through EAB, the parents must contact at the local Social Security office. Since parents generally need an SSN for various reasons in the first year of a child's life, such as listing a child as a dependent on a tax return, it is unusual for an SSN application to be delayed past that first year. In addition to verifying birth certificates that are suspicious for any reason, in June 2002 we began verifying all birth certificates with the issuing states for children age 1 and over. In some cases these verifications can be done electronically, in others a paper process is used. Again these verifications can delay issuance of the SSN, causing inconvenience to the parents, but we believe this process is valuable in ensuring that SSNs are not issued inappropriately.
SSA is leading a new government project to facilitate the verification of vital statistics such as birth records. "E-Vital" should reduce the cost and time it takes to verify both birth and death information. While we continue to look for ways to improve our current processes, clearly implementation of these linkages would facilitate our ability to verify birth certificates. E-Vital would reduce resources needed to do these verifications by eliminating the very labor intensive paper process and reduce or eliminate the extra time parents must wait to get an SSN. At the e-Gov 2003 Conference and Exposition in June, SSA received the Pioneer Award in the area of e-Government for the e-Vital program.
To test the feasibility of bringing a tighter focus overall on issues related to the assignment of SSNs, we opened a Social Security Card Center in Brooklyn, New York in November 2002. The center represents a joint effort between SSA, SSA's Office of the Inspector General and the DHS Bureau of Citizenship and Immigrations Services (BCIS). Employees from SSA work with staff from these agencies to bring together in a single office the technical and investigative perspectives of each of the participating agencies. The results have been encouraging, and we are considering whether additional card centers would be successful in other parts of the Country.
We have taken a number of steps to protect the privacy of people's SSNs when they receive correspondence from us. For example, since late 2001, we no longer include the first five digits of the SSN on Social Security Statements or on Social Security cost-of-living notices. Envelopes completely conceal SSNs when they are included in correspondence where an SSN is necessary. Further, the Department of Treasury plans to implement procedures in 2004 that will end the necessity of including on paper checks the SSN of the individual to whom the check has been made payable.
In our efforts to enhance the integrity of our enumeration processes and further reduce opportunities for fraud through misuse and/or improper attainment of SSNs, we proposed changing our evidence requirements for assignment of SSNs and by defining "valid nonwork reasons." In March 2002, SSA stopped assigning SSNs to noncitizens for the sole purpose of applying for a driver's license. We would issue an SSN to noncitizens only if they were authorized to work or where needed for a federally funded or state public assistance benefit. This closed a loophole on noncitizens applying for drivers' licenses just to get an SSN. At that time, we issued a letter to Governors in advance of the change. We also notified the American Association of Motor Vehicle Administrators (AAMVA) of the change.
A lawsuit was filed in the U.S. District Court for the District of Columbia on behalf of nonimmigrants residing in Illinois and Alabama who were denied SSNs for drivers' license purposes (Iyengar v. B. Barnhart) 233 F. Supp. 221-5 (D.D.C.-2002). On November 26, 2002, the U.S. District Court issued a decision holding that the March 2002 change to our program instructions was invalid and that SSA must use notice-and-comment procedures to effectuate this change. As a result of that case, in December 2002, we reinstated our prior policy pending publication of the proposed change in the Federal Register.
On March 26, 2003, we published a proposed rule to allow us to resume the restriction on nonwork SSNs by announcing that we would define a "valid nonwork purpose'' as those instances when a Federal statute or regulation requires a non citizen to have an SSN in order to receive a federally-funded benefit to which the non citizen has established entitlement, or when a State or local law requires an non citizen who is legally in the U.S. to have an SSN in order to receive general public assistance benefits to which the non citizen has established entitlement. In so doing, we will no longer issue an SSN so that a noncitizen may qualify to apply for a driver's license.
We also announced in that proposed rule that we would require an in-person interview with all individuals age 12 or older who are applying for an original SSN, and we will no longer waive the requirement to provide evidence of identity in original applications for a child under age 7.
The public comment period for these proposed changes ended on May 27, and we expect to implement these changes upon publication of the final rules.
Verification of SSNs
On an ongoing basis, SSA currently provides over 770 million SSN verifications a year to many thousands of different users, and the number of requests and users continues to grow rapidly. It is important to remember that when SSA receives a request for verification of an SSN, all we can really verify is whether the information included in the request, name, date of birth, etc., matches the information in our records for that SSN. Even if that information does match, it is no guarantee that the person presenting that SSN to the requesting agency or employer is in fact the person to whom that SSN was originally issued.
We have created a pilot of a web-based on-line system for employers to verify the names and SSNs of newly hired employees. This system, the Social Security Number Verification Service, is also known as SSNVS. It supplements other SSN verification systems that have been available to employers for more than twenty years. Currently, 69 companies have enrolled to participate in the pilot, and employers have used SSNVS over 8,800 times to verify over 1.7 million SSNs.
One of the services offered by SSA to certain government agencies that use the SSN is to verify SSNs that have been provided to them by individuals who have applied for services from that agency. A partial list of the various users of these verification services include:
- The Department of Education to verify the SSN's of individuals applying for federal student aid
- State human services agencies for TANF, Medicaid, unemployment insurance, worker's compensation and pension coordination
- HHS, Office of Child Support Enforcement (OCSE) to manage their database of SSNs and new hires
- Prisons to verify the SSNs of inmates whose benefits should be suspended because of their incarceration
- The Office of the Inspector General (OIG) to assist in criminal and fraud investigations and to help track fugitive felons
- Department of Justice and state and local law enforcement agencies to assist in certain criminal matters and fraud investigations and to help track fugitive felons
- The Department of Veteran's Affairs for applicants for VA benefits and medical services
- The Department of Homeland Security for immigration purposes
- The Department of State for immigration purposes
- The Department of Defense for employees and military inductees
- Internal SSA users for purposes of administering benefits programs
- Federal Emergency Management Administration (FEMA) for emergency relief benefit coordination
- SSA provides SSN verification service to meet the needs of state Departments of Motor Vehicles.
Verification of SSNs for Driver's Licenses
While many of these verifications are geared toward preventing abuse of welfare and other cash paying benefit programs, the verification service we provide to the departments of motor vehicles are especially important with respect to the prevention of crimes related to identity theft and fraud. Since 1997, SSA has worked jointly with the American Association of Motor Vehicle Administrators (AAMVA) to provide an SSN verification service that is tailored to the needs of state Departments of Motor Vehicles (DMVs).
The SSA Online Verification Service (SSOLV) enables DMVs to request verification of an SSN from SSA while processing an application for a driver's license. Under this service, DMV employees enter the data necessary for verification through software maintained and administered by AAMVA. The software directs the request to SSA, where the information that has been entered by the DMV is to be compared to information housed in SSA's records for the individual who has applied for a driver's license. Requests are received by SSA and returned in 1 second or less for 93 percent of these transactions. If our records indicate that an individual applying for a driver's license is deceased, we inform the DMV that there is an issue on our records that must be resolved with SSA. In addition to the online service, state DMVs may submit large numbers of drivers license records to SSA directly for verification. We refer to these as "batch" requests.
Currently, 34 states (including the District of Columbia) have entered into agreements to use the online service. Of those states, 22 states are using the online verification process and four states have begun testing their software with SSA. Nine states have agreements, but have not yet begun testing. (An additional state is testing with SSA but has not yet entered into an agreement). AAMVA plans to begin a renewed campaign to educate the states about the improvements to the process. In FY 2003, we estimate that we will process over 6 million requests from DMVs. AAMVA estimates that with the increased participation and improved systems performance, the number of requests processed in FY 2004 will be approximately 20 million. We expect our current, already low, cost of 3.4 cents per transaction to drop with this increased volume.
Unlike SSOLV, the batch process does not provide information that a death indicator exists in our records. Currently only seven states are using the batch verification process. The primary reason that they use this slower system seems to be cost. The General Accounting Office has recommended that SSA should modify the batch method to include a match against nationwide death records. We agree, and we are working to develop a remedy.
However, increasing the use of the online SSOLV system by the states is the best way to improve the integrity of the licensing system. First and foremost, it provides verification information to the MVA while the driver's license applicant is still at their counter. Negative verification gives the DMV the data it needs to prevent issuance of the driver's license. It is also the most efficient and cost-effective method for the states because it eliminates the need to issue temporary licenses while awaiting the results of the batch verification requests, a process used by some DMVs. This is why SSA is committed to pursuing and expanding the online service. It is a system that works well, works quickly and ensures that fewer people will be able to obtain driver's licenses with fraudulent documentation.
I would like to conclude by emphasizing that we at the Social Security Administration are committed to strengthening the integrity of the processes that we use to assign SSNs. We believe the recent improvements we have implemented have made it more difficult for individuals to obtain SSNs from us through fraudulent means.
The difficult challenge we face is to balance SSA's commitment to assigning numbers quickly and accurately to individuals who qualify for them and need them to work, with the equally important need to maintain the integrity of the enumeration system to prevent SSN fraud and misuse. The President's budget request for FY 2004 includes the funding we need to continue our efforts to meet this challenge.
We have worked in the past and will continue to do so in the future with other Agencies-at the Federal, State and local levels-to assist them in making their processes less vulnerable to those who are intent on committing identity crimes. Together we can take action to thwart those who would abuse the SSN and other agencies' records to perpetrate identity crimes that burden Americans and threaten the security of our nation.